👷(ci) ignore trivy scan output temporary

CVE-2025-13601 has yet no fix. I don't want to migrate the base image in this pull request, as it could introduce regression. I'll open an issue to fix this CVE later on. The summary service isn't exposed on internet, and the agent isn't used in production.
🔧(ci) add trivy scans for summary and agent
2026-01-06 19:44:06 +01:00 · 2026-01-06 19:05:29 +01:00 · 2026-01-06 17:00:00 +01:00 · 2026-01-06 16:43:15 +01:00 · 2026-01-06 16:43:15 +01:00 · 2026-01-05 18:10:05 +01:00
16 changed files with 63 additions and 28 deletions
@@ -147,6 +147,14 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/summary/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+          docker-context: './src/summary'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -178,6 +186,14 @@ jobs:
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/agents/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+          docker-context: './src/agents'
      -
        name: Build and push
        uses: docker/build-push-action@v6
@@ -8,13 +8,24 @@ and this project adheres to

 ## [Unreleased]

+### Changed
+
+- 📈(frontend) track new recording's modes
+
+## [1.2.0] - 2026-01-05
+
+### Added
+
 - ✨(agent) support Kyutai client for subtitle
- ✨(frontend) remove the beta badge
 - ✨(all) support starting transcription and recording simultaneously
 - ✨(backend) persist options on a recording
 - ✨(all) support choosing the transcription language
 - ✨(summary) add a download link to the audio/video file
 - ✨(frontend) allow unprivileged users to request a recording
+
+### Changed
+
+- 🚸(frontend) remove the beta badge
 - ♻️(summary) extract file handling in a robust service
 - ♻️(all) manage recording state on the backend side

@@ -1,7 +1,7 @@
 APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"

-AWS_STORAGE_BUCKET_NAME="meet-media-storage"
+AWS_STORAGE_BUCKET_NAME="http://meet-media-storage"
 AWS_S3_ENDPOINT_URL="minio:9000"
 AWS_S3_SECURE_ACCESS=false

@@ -1,7 +1,7 @@

 [project]
 name = "agents"
-version = "1.1.0"
+version = "1.2.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.3.10",
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "meet"
-version = "1.1.0"
+version = "1.2.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -56,7 +56,7 @@ dependencies = [
    "whitenoise==6.11.0",
    "mozilla-django-oidc==4.0.1",
    "livekit-api==1.0.7",
-    "aiohttp==3.13.2",
+    "aiohttp==3.13.3",
 ]

 [project.urls]
@@ -1,12 +1,12 @@
 {
  "name": "meet",
-  "version": "1.1.0",
+  "version": "1.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "meet",
-      "version": "1.1.0",
+      "version": "1.2.0",
      "dependencies": {
        "@fontsource-variable/material-symbols-outlined": "5.2.30",
        "@fontsource/material-icons-outlined": "5.2.6",
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.1.0",
+  "version": "1.2.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -5,7 +5,6 @@ import { useRoomId } from '@/features/rooms/livekit/hooks/useRoomId'
 import { useRoomContext } from '@livekit/components-react'
 import {
  RecordingMode,
-  useHasFeatureWithoutAdminRights,
  useHumanizeRecordingMaxDuration,
  useRecordingStatuses,
 } from '@/features/recording'
@@ -19,7 +18,6 @@ import {
 } from '@/features/notifications'
 import posthog from 'posthog-js'
 import { useConfig } from '@/api/useConfig'
-import { FeatureFlags } from '@/features/analytics/enums'
 import { NoAccessView } from './NoAccessView'
 import { ControlsButton } from './ControlsButton'
 import { RowWrapper } from './RowWrapper'
@@ -28,6 +26,7 @@ import { Checkbox } from '@/primitives/Checkbox'
 import { useTranscriptionLanguage } from '@/features/settings'
 import { useMutateRecording } from '../hooks/useMutateRecording'
 import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'
+import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner.ts'

 export const ScreenRecordingSidePanel = () => {
  const { data } = useConfig()
@@ -38,10 +37,7 @@ export const ScreenRecordingSidePanel = () => {

  const [includeTranscript, setIncludeTranscript] = useState(false)

-  const hasFeatureWithoutAdminRights = useHasFeatureWithoutAdminRights(
-    RecordingMode.ScreenRecording,
-    FeatureFlags.ScreenRecording
-  )
+  const isAdminOrOwner = useIsAdminOrOwner()

  const { notifyParticipants } = useNotifyParticipants()
  const { selectedLanguageKey, isLanguageSetToAuto } =
@@ -98,14 +94,17 @@ export const ScreenRecordingSidePanel = () => {
        await notifyParticipants({
          type: NotificationType.ScreenRecordingStarted,
        })
-        posthog.capture('screen-recording-started', {})
+        posthog.capture('screen-recording-started', {
+          includeTranscript: includeTranscript,
+          language: selectedLanguageKey,
+        })
      }
    } catch (error) {
      console.error('Failed to handle recording:', error)
    }
  }

-  if (hasFeatureWithoutAdminRights) {
+  if (!isAdminOrOwner) {
    return (
      <NoAccessView
        i18nKeyPrefix={keyPrefix}
@@ -117,7 +117,10 @@ export const TranscriptSidePanel = () => {
        await notifyParticipants({
          type: NotificationType.TranscriptionStarted,
        })
-        posthog.capture('transcript-started', {})
+        posthog.capture('transcript-started', {
+          includeScreenRecording: includeScreenRecording,
+          language: selectedLanguageKey,
+        })
      }
    } catch (error) {
      console.error('Failed to handle transcript:', error)
@@ -150,7 +150,7 @@ summary:
    APP_NAME: summary-microservice
    APP_API_TOKEN: password
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
    AWS_S3_ACCESS_KEY_ID: meet
    AWS_S3_SECRET_ACCESS_KEY: password
    AWS_S3_SECURE_ACCESS: False
@@ -187,7 +187,7 @@ celeryTranscribe:
    APP_NAME: summary-microservice
    APP_API_TOKEN: password
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
    AWS_S3_ACCESS_KEY_ID: meet
    AWS_S3_SECRET_ACCESS_KEY: password
    AWS_S3_SECURE_ACCESS: False
@@ -225,7 +225,7 @@ celerySummarize:
    APP_NAME: summary-microservice
    APP_API_TOKEN: password
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
    AWS_S3_ACCESS_KEY_ID: meet
    AWS_S3_SECRET_ACCESS_KEY: password
    AWS_S3_SECURE_ACCESS: False
@@ -1,12 +1,12 @@
 {
  "name": "mail_mjml",
-  "version": "1.1.0",
+  "version": "1.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "mail_mjml",
-      "version": "1.1.0",
+      "version": "1.2.0",
      "license": "MIT",
      "dependencies": {
        "@html-to/text-cli": "0.5.4",
@@ -1,6 +1,6 @@
 {
  "name": "mail_mjml",
-  "version": "1.1.0",
+  "version": "1.2.0",
  "description": "An util to generate html and text django's templates from mjml templates",
  "type": "module",
  "dependencies": {
@@ -1,12 +1,12 @@
 {
  "name": "sdk",
-  "version": "1.1.0",
+  "version": "1.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sdk",
-      "version": "1.1.0",
+      "version": "1.2.0",
      "license": "ISC",
      "workspaces": [
        "./library",
@@ -1,6 +1,6 @@
 {
  "name": "sdk",
-  "version": "1.1.0",
+  "version": "1.2.0",
  "author": "",
  "license": "ISC",
  "description": "",
@@ -1,7 +1,7 @@

 [project]
 name = "summary"
-version = "1.1.0"
+version = "1.2.0"
 dependencies = [
    "fastapi[standard]>=0.105.0",
    "uvicorn>=0.24.0",
@@ -21,8 +21,14 @@ class FileService:
        """Initialize FileService with MinIO client and configuration."""
        self._logger = logger

+        endpoint = (
+            settings.aws_s3_endpoint_url.removeprefix("https://")
+            .removeprefix("http://")
+            .rstrip("/")
+        )
+
        self._minio_client = Minio(
-            settings.aws_s3_endpoint_url,
+            endpoint,
            access_key=settings.aws_s3_access_key_id,
            secret_key=settings.aws_s3_secret_access_key.get_secret_value(),
            secure=settings.aws_s3_secure_access,
Author	SHA1	Message	Date
lebaudantoine	05bde6e957	👷(ci) ignore trivy scan output temporary CVE-2025-13601 has yet no fix. I don't want to migrate the base image in this pull request, as it could introduce regression. I'll open an issue to fix this CVE later on. The summary service isn't exposed on internet, and the agent isn't used in production.	2026-01-06 19:44:06 +01:00
lebaudantoine	5bbd619791	🔧(ci) add trivy scans for summary and agent Closes #685: add a Trivy scan to the CI build steps for Meet Summary and Meet Agents to ensure no vulnerabilities are present before pushing images to the registry.	2026-01-06 19:05:29 +01:00
renovate[bot]	d7ad5aed05	⬆️(dependencies) update aiohttp to v3.13.3 [SECURITY]	2026-01-06 17:00:00 +01:00
lebaudantoine	4acc9cf40d	🩹(frontend) render the NoAccessView for unprevileged users Simplify a broken conditional check that allowed users without the required permissions to see the control menu. The `NoAccessView` is now shown to any user who is neither an admin nor the meeting owner.	2026-01-06 16:43:15 +01:00
lebaudantoine	13d0d3d801	📈(frontend) track metadata on recording-started events I introduced transcript + screen recording modes but forgot to properly track them in PostHog. Fix this issue.	2026-01-06 16:43:15 +01:00
lebaudantoine	47cd3eff74	🔖(minor) bump release to 1.2.0	2026-01-05 18:10:05 +01:00
lebaudantoine	5769203705	💄(frontend) add minor layout adjustments Propose minor layout adjustments to ensure the DINUM version with French copywriting does not look visually awkward due to line breaks.	2026-01-05 17:47:26 +01:00
lebaudantoine	cadc186c62	🐛(backend) fix certificates volume mount path for Python 3.13 After upgrading Python to 3.13, not all development environments were updated accordingly. This fixes the incorrect volume mount path introduced by that upgrade.	2026-01-05 17:47:26 +01:00
lebaudantoine	5be7595533	🐛(summary) fix MinIO endpoint handling in constructor Fix MinIO client configuration: I was incorrectly passing a full URL instead of an endpoint, which caused errors in staging. Local development values did not reflect the staging setup and were also out of sync with the backend.	2026-01-05 15:40:11 +01:00